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Information Commissioner's Office 


DATA PROTECTION ACT 1998 


SUPERVISORY POWERS OF THE INFORMATION COMMISSIONER 


MONETARY PENALTY NOTICE 


Seaview Brokers Limited 


Demar House, 14 Church Road, East Wittering, Chichester, West 
Sussex, PO20 8PS 


The Information Commissioner (“the Commissioner”) has decided to 
issue Seaview Brokers Limited (“Seaview”) with a monetary penalty 
under section 55A of the Data Protection Act 1998 (“DPA”). The penalty 
is in relation to a serious contravention of regulation 21 of the Privacy 
and Electronic Communications (EC Directive) Regulations 2003 
(“PECR”). 


This notice explains the Commissioner's decision. 


Legal framework 


Seaview, whose registered office is given above (Companies House 
Registration Number: 12213438) is the organisation stated in this 
notice to have used a public electronic communications service for the 
purpose of making unsolicited calls for the purposes of direct marketing 


contrary to regulation 21 of PECR 
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Regulation 21 applies to the making of unsolicited calls for direct 
marketing purposes. It means that if a company wants to make calls 
promoting a product or service to an individual who has a telephone 
number which is registered with the Telephone Preference Service Ltd 


(“TPS”), then that individual must have notified the company that they 


do not object to receiving such calls from it. 
Regulation 21 paragraph (1) of PECR provides that: 


"(1) A person shall neither use, nor instigate the use of, a public 
electronic communications service for the purposes of making 


unsolicited calls for direct marketing purposes where- 


(a) the called line is that of a subscriber who has previously 
notified the caller that such calls should not for the time being 


be made on that line; or 


(b) the number allocated to a subscriber in respect of the called 


line is one listed in the register kept under regulation 26.” 
Regulation 21 paragraphs (2), (3), (4) and (5) provide that: 


"(2) A subscriber shall not permit his line to be used in contravention 


of paragraph (1). 


(3) A person shall not be held to have contravened paragraph (1)(b) 
where the number allocated to the called line has been listed on the 
register for less than 28 days preceding that on which the call is 


made. 
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(4) Where a subscriber who has caused a number allocated to a line of 
his to be listed in the register kept under regulation 26 has notified 
a caller that he does not, for the time being, object to such calls 
being made on that line by that caller, such calls may be made by 


that caller on that line, notwithstanding that the number allocated 


to that line is listed in the said register. 


(5) Where a subscriber has given a caller notification pursuant to 


paragraph (4) in relation to a line of his— 


(a) the subscriber shall be free to withdraw that notification at 
any time, and 
(b) where such notification is withdrawn, the caller shall not 


make such calls on that line.” 


Under regulation 26 of PECR, the Commissioner is required to maintain 
a register of numbers allocated to subscribers who have notified them 
that they do not wish, for the time being, to receive unsolicited calls for 
direct marketing purposes on those lines. The Telephone Preference 
Service Limited (“TPS”) is a limited company which operates the 
register on the Commissioner’s behalf. Businesses who wish to carry 
out direct marketing by telephone can subscribe to the TPS for a fee 


and receive from them monthly a list of numbers on that register. 


Section 122(5) of the DPA18 defines direct marketing as “the 
communication (by whatever means) of advertising or marketing 
material which is directed to particular individuals”. This definition also 
applies for the purposes of PECR (see regulation 2(2) PECR & Schedule 
19 paragraphs 430 & 432(6) DPA18). 
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“Individual” is defined in regulation 2(1) of PECR as “a living individual 


and includes an unincorporated body of such individuals”. 


A “subscriber” is defined in regulation 2(1) of PECR as “a person who is 
a party to a contract with a provider of public electronic 


communications services for the supply of such services”. 


Section 55A of the DPA (as applied to PECR cases by Schedule 1 to 


PECR, as variously amended) states: 


"(1) The Commissioner may serve a person with a monetary penalty if 


the Commissioner is satisfied that —- 


(a) there has been a serious contravention of the requirements 
of the Privacy and Electronic Communications (EC 


Directive) Regulations 2003 by the person, 
(b) subsection (2) or (3) applies. 
(2) This subsection applies if the contravention was deliberate. 


(3) This subsection applies if the person - 
(a) knew or ought to have known that there was a risk that 
the contravention would occur, but 
(b) failed to take reasonable steps to prevent the 


contravention. 


The Commissioner has issued statutory guidance under section 55C (1) 
of the DPA about the issuing of monetary penalties that has been 
published on the ICO’s website. The Data Protection (Monetary 
Penalties) (Maximum Penalty and Notices) Regulations 2010 prescribe 
that the amount of any penalty determined by the Commissioner must 
not exceed £500,000. 
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PECR were enacted to protect the individual’s fundamental right to 
privacy in the electronic communications sector. PECR were 
subsequently amended and strengthened. The Commissioner will 
interpret PECR in a way which is consistent with the Regulations’ 


overall aim of ensuring high levels of protection for individuals’ privacy 


rights. 


The provisions of the DPA remain in force for the purposes of PECR 
notwithstanding the introduction of the DPA18: see paragraph 58(1) of 
Schedule 20 to the DPA18. 


Background to the case 


Seaview first came to the attention of the Commissioner in June 2020 
following intelligence received relating to an unsolicited marketing call 


about white goods maintenance. The complaint identified a company 


nomea aT 


The Commissioner conducted a search for complaints to the TPS and 
her online reporting tool (“OLRT”) in relation to the identified company. 
This identified a further complaint about an unsolicited direct marketing 
call from a particular Calling Line Identifier (“CLI”). This complaint 


related to insurance for television: - 


- “to discuss insurance of a television. Rang off when wife passed the 


phone to me. Latest in series of calls, 29/4 I +/5 Gy 
and 18/5 (again indeed stretching back several months.. All to 


discuss renewal of appliance protection previously cancelled that 


was provided by I, These individuals disclaim 


any connection with that company but the information they quote to 

myself or my wife, including premiums and renewal dates, can only 

have come from ME The calling numbers vary as well. 
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Our solicitor has formerly advised Eee a in May, of our 
cancellation of their 'plan' but the company ignores 


correspondence.” 


- “As soon as I said that we did not have insurance they hang up” 


17. The Commissioner sent a Third-Party Information Notice (“3PIN”) to 
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the Communications Service Provider (“CSP”), i, for 
the CLI in question on 6 July 2020 requesting the identity of the CLI’s 


subscriber. The response, which was received on 7 July 2020, identified 
the subscriber as Seaview, and provided a list of CLI’s allocated to 
them. It also provided Call Detail Records (“CDR’s”) for the identified 
CLI’s between 1 June 2020 and 30 June 2020. 


The Commissioner calculated the number of calls which had originated 
from CLI’s attributed to Seaview between 1 June 2020 and 30 June 
2021 and established that there had been 12,571 calls made in total. 


The Commissioner subsequently screened the CDR’s against the TPS 
register to establish whether any of the calls had been made to TPS 
registered numbers. Results showed that a total of 4,737 calls had 
been made to telephone numbers which had been registered with the 
TPS for not less than 28 days. Out of the total number of 12,571 
telephone calls made, this equated to 38% of connected outbound calls 


made during the period. 


The Commissioner sent an initial investigation letter by post and e-mail 
to Seaview on 21 August 2020, setting out her concerns with Seaview’s 
PECR compliance and asking for details of call volumes and information 


relating to its direct marketing activity. 
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On the 23 and 24 August 2020 the Commissioner received responses 
from Seaview setting out that it had no links with qa 
except the purchase of its direct debit book. They explained that by 
Seaview purchasing the direct debit book it prevented customers losing 
out on contracts already paid for. It stated that on taking over the 
accounts each customer was given a new contract which included the 
right to be contacted by Seaview. They said that they did not engage in 
outbound marketing calls and that they believed Seaview was legally 
entitled to contact the customers it purchased from B. 


The Commissioner responded to confirm that she had received 
information from Seaview’s CSP that the CLI’s in question were 
allocated to them and had made a total of 12,571 calls during the 
month of June 2020. The Commissioner requested that they provide 


responses to her enquiries. 


Seaview advised by return that it was in the process of becoming a 
Financial Conduct Authority regulated insurance provider and that it 
would continue to contact customers to inform of cancellations, missing 


payments or to inform them that Seaview had taken over the contract. 


On the 28 August 2020 Seaview provided responses to the 
Commissioners initial enquiries. They confirmed that one of the CLI’s 
identified was in use and that the data book purchased from aaa 
M contained data originally supplied by two third party suppliers. 
Seaview confirmed that it did not operate a suppression list and were 
unable to provide evidence that individuals had not objected to the 


marketing calls but reiterated that the calls were made to those on the 


database purchased from ay. 


The Commissioner requested further information on 16 September 


2020 including evidence of the due diligence it conducted on the 
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purchased database, original data source opt in statements, 


confirmation of when Seaview purchased the data book and around its 


reliance on legitimate interests for marketing. 


Seaview responded to the Commissioner on 29 September 2020 
explaining that the company had been set up three weeks prior to the 
first government imposed Covid-19 lockdown. It was set to become 
regulated by a principal firm to sell insurance online. It had purchased 
the data book from containing 10,000 customers in the 
hope it could move the customers on to a regulated product if they 
renewed their contract. They also explained that Seaview telephoned 
customers and sent new paperwork to them to advise that it had taken 


over the service. 


The following day, on the 30 September 2020, Seaview provided the 
Commissioner with a copy document between themselves and ial 
WE garding the purchase of the data book. The agreement was 
signed by both parties but included no terms or details of the purchase, 


such as the size of the database or the price paid. 


On 20 October 2020 the Commissioner wrote again to Seaview to 
explain that it had received evidence of unsolicited marketing calls 
made by them and needed to establish how many calls had been 
made, and whether the individuals had stated they did not object to 
receiving such calls from them. She again requested a full response to 


her enquiries of the 16 September 2020. 


In its response of the 26 October 2020 Seaview explained that the data 
book it purchased was for active customers and it only made calls to 


advise it had taken over the customers contracts. It stated that all 


customers had engaged PE services for at least six 


months. They also explained that TPS screening and suppression lists 
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would be used by Seaview if they decided to conduct a direct 


marketing campaign. 


On 12 November 2020 the Commissioner invited Seaview to attend a 
fact-finding meeting. Due to delays caused by the Covid-19 pandemic 
this meeting was held on 18 January 2021. At the meeting Seaview 
confirmed the names of the two data providers used by a 
| and that these were the only providers they were aware of. 
The Commissioner expressed concern about the lack of provision of 
evidence that the individuals called had not objected to receiving the 
calls. The evidence that had been provided showed that the data used 
by ME had originally been obtained via a lifestyle survey. 
The survey had asked individuals to agree to telephone marketing from 
sponsors listed at the end of the call. Individuals were not able to fine 
tune their marketing preferences, and they were not told how they 
could opt out. Furthermore, only industry sectors were listed at the end 
of the call, which was played after the individuals had given their 


consent. There were no individual companies named and there was no 


reference to, at all. 


In the meeting the Commissioner also expressed concern about the 
copy agreement provided between itself anc |. Seaview 
responded by explaining that it had not paid anything yet as the 
arrangement was supposed to be on an informal basis. The 
Commissioner again set out that it had obtained its CDR’s for June 
2020 and a significant number of calls had been made to TPS 


registered telephone numbers. 


Following the meeting, the Commissioner requested that Seaview 


provide further evidence including a copy of the contract aaa 


GEE issued to its customers, correspondence sent by B 


WE vegarding the sale of the data book, its terms and conditions, 
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total costs of the book, volume of customers Seaview purchased and a 


copy of the invoice for the data book. 


Seaview responded on the 13 April 2021 following attempts to send the 
evidence which was not received. They provided a copy of the contract 
between itself and ME for the purchase of the data book. 
Seaview considered that it had provided all the information that it was 


able to the Commissioner and that anything further should be sought 


from ine directly. 


On the 20 April 2021 the Commissioner sent an end of investigation 


letter. 


The Commissioner is satisfied that the 4,737 calls were all made for the 


purposes of direct marketing as defined by section 122(5) DPA18. 


The Commissioner has made the above findings of fact on the 


balance of probabilities. 

The Commissioner has considered whether those facts constitute a 
contravention of regulation 21 of PECR by Seaview and, if so, whether 
the conditions of section 55A DPA are satisfied. 


The contravention 


The Commissioner finds that Seaview contravened regulation 21 of 
PECR. 


The Commissioner finds that the contravention was as follows: 


Between 1 June 2020 and 30 June 2020, Seaview used a public 


telecommunications service for the purposes of making 4,737 
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unsolicited calls for direct marketing purposes to subscribers where the 
number allocated to the subscriber in respect of the called line was a 
number listed on the register of numbers kept by the Commissioner in 


accordance with regulation 26, contrary to regulation 21(1)(b) of PECR. 


The Commissioner is also satisfied for the purposes of regulation 21 
that these 4,737 unsolicited direct marketing calls were made to 
subscribers who had registered with the TPS at least 28 days prior to 
receiving the calls, and who for the purposes of regulation 21(4) had 


not notified Seaview that they did not object to receiving such calls. 


For such notification to be valid under regulation 21(4), the individual 
must have taken a clear and positive action to override their TPS 
registration and indicate their willingness to receive marketing calls 
from the company. The notification should reflect the individual’s 
choice about whether or not they are willing to receive marketing calls. 
Therefore, where signing up to use a product or service is conditional 
upon receiving marketing calls, companies will need to demonstrate 
how this constitutes a clear and positive notification of the individual’s 


willingness to receive such calls. 


The notification must clearly indicate the individual’s willingness to 
receive marketing calls specifically. Companies cannot rely on 
individuals opting in to marketing communications generally, unless it 


is clear that this will include telephone calls. 


Further, the notification must demonstrate the individual’s willingness 
to receive marketing calls from that company specifically. Notifications 
will not be valid for the purposes of regulation 21(4) if individuals are 

asked to agree to receive marketing calls from “similar organisations”, 


“partners”, “selected third parties” or other similar generic descriptions. 
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Seaview has been unable to provide any evidence that the subscribers 
who received these calls had notified Seaview that they did not, for the 
time being, object to such calls. Seaview has not provided the 
Commissioner with a copy of the contract sent bp ii to its 
customers. The Commissioner has therefore been unable to assess 
whether anything in that contract gave permission for it to transfer 
individual’s data to another organisation, including for marketing 
purposes. Indeed, evidence of an example consent statement used to 
gather consent by the data providers via a lifestyle survey did not 
appear to comply with PECR as individuals were not informed about 
who may contact them with marketing, or were able to choose who 


they receive marketing from. 


The Commissioner has gone on to consider whether the conditions 


under section 55A DPA are met. 
Seriousness of the contravention 


The Commissioner is satisfied that the contravention identified above 
was serious. This is because there have been multiple breaches of 
regulation 21 by Seaview arising from the organisation’s activities 
between 1 June 2020 and 30 June 2020, and this led to 4,737 
unsolicited direct marketing calls being made to subscribers who were 
registered with the TPS and who had not notified Seaview that they 


were willing to receive such calls. 


The Commissioner considered the arrangement between Seaview and 


EE 20d took the view that it did not amount to a 


contract as there did not appear to be any consideration made by way 


of a payment for the data book. There was no information regarding 
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what obligations were created for the parties with regards to its 
ongoing obligations to the customers and who would provide the 
services which were the subject of the consumers contracts. For this 
reason, the Commissioner considered that there was no existing 


relationship between the two companies and that the calls made by 


Seaview amounted to marketing calls as the complaint suggested. 


The Commissioner is therefore satisfied that condition (a) from 
section 55A (1) DPA is met. 


Deliberate or negligent contraventions 


The Commissioner has considered whether the contravention identified 
above was deliberate. In the Commissioner's view, this means that 
Seaview’s actions which constituted that contravention were deliberate 
actions (even if Seaview did not actually intend thereby to contravene 
PECR). 


The Commissioner does not consider that Seaview deliberately set out 


to contravene PECR in this instance. 


The Commissioner has gone on to consider whether the contravention 
identified above was negligent. This consideration comprises two 


elements: 


Firstly, he has considered whether Seaview knew or ought reasonably 
to have known that there was a risk that this contravention would 


occur. He is satisfied that this condition is met. 


Seaview agreed to ‘purchase’ the data book rom 


without reviewing evidence of consent or conducting proper effective 
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due diligence. It went on to use the data to contact individuals and 


make direct marketing calls in contravention of PECR. 


The Commissioner has also published detailed guidance for companies 
carrying out marketing explaining their legal requirements under PECR. 
This guidance explains the circumstances under which organisations 
are able to carry out marketing over the phone, by text, by email, by 
post or by fax. Specifically, it states that live calls must not be made to 
any subscriber registered with the TPS, unless the subscriber has 
specifically notified the company that they do not object to receiving 
such calls. In case organisations remain unclear on their obligations, 
the ICO operates a telephone helpline. ICO communications about 
previous enforcement action where businesses have not complied with 


PECR are also readily available. 


It is therefore reasonable to suppose that Seaview should have been 


aware of its responsibilities in this area. 


Secondly, the Commissioner has gone on to consider whether Seaview 
failed to take reasonable steps to prevent the contravention. Again, he 


is satisfied that this condition is met. 


Seaview seemingly took no steps to ensure that the data it used was 
screened against the TPS every 28 days. This is evident from the very 
high percentage of calls made to TPS registered telephone numbers. 
This is a basic requirement for any organisation conducting a live 


marketing campaign. It also did not operate a suppression list. 


It is important to remember that even if individuals don’t object to calls 
(for example by not ticking an opt-out box) this doesn’t overrule any 


existing TPS registration. This means that a company has to screen all 
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numbers against this register and they can’t call any number that 

appears on the lists. If they want to call a number registered with the 

TPS the individual must have specifically told them that they want their 

marketing calls in order to override their general objection to such 

calls. In order to prove that the individual notified the company that 

they could call their TPS registered number, the company needs to 

have a record of it. It is not enough that someone simply failed to 

object to past calls, or failed to take positive steps to opt-out of their 

calls. For example, a company cannot assume that failing to click on an 

opt-out, or not replying to a letter inviting them to opt-out, is 

notification that they do not object to its calls. The individuals must 

have taken a proactive step to ‘notify’ the company that they wish to 


receive direct marketing calls from it. 


Seaview also failed to carry out satisfactory due diligence on the data 
book prior to or at the time of its ‘purchase’ and was instead content to 
rely on assurances that as they were apparent customers of i 
GR they were entitled to make the direct marketing calls. 


Reasonable steps in these circumstances may also have included 
conducting thorough checks on all of the data it was to use for its 
direct marketing campaigns; or at least obtaining and recording 
evidence of notification from those TPS-registered individuals whom 
had indicated that they did not object to receiving marketing calls from 


Seaview. 


Seaview has maintained that the calls it made were not marketing in 
nature, however, the complaints received suggest otherwise. It is 
arguable that Seaview did not need to make the call at all given that it 
informed the Commissioner that it contacted the individuals to inform 


them it had taken over their contracts by post. Seaview could therefore 
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have mitigated the risk of making unsolicited marketing calls in breach 
of PECR. 


63. Given the volume of calls, it is clear that Seaview failed to take those 


reasonable steps. 


The Commissioner is therefore satisfied that condition (b) from section 55A 
(1) DPA is met. 


The Commissioner's decision to issue a monetary penalty 


64. The Commissioner has taken into account the following aggravating 


features of this case: 


e To date, the Commissioner’s understanding of this type of marketing is 
that it can often involve the targeting of vulnerable individuals and also 
be aggressive in nature. Whilst only 1 complaint has been identified to 
date within the contravention period, the content of this complaint 


indicates as such. 


e The actions of Seaview were carried out to generate business and to 
increase profits, gaining an unfair advantage on those businesses 
complying with PECR. It was also noted that these calls could potentially 
result in recurring revenue as opposed to singular ‘one-off’ payments, if 


Direct Debits were set up as a consequence of the calls; 


e The Commissioner noted the issues in relation to Seaview’s record- 
keeping, particularly with regards to the apparent lack of documents 
relating to the purchase of the direct debit book; the database that was 
used to make the calls in contravention of Regulation 21 of PECR. It is 


anticipated that any Company purchase would have generated records. 
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The Commissioner did not identify any mitigating features in this case. 


The Commissioner has considered the likely impact of a monetary 
penalty on Seaview. He has decided on the information that is available 
to him, that a penalty remains the appropriate course of action in the 


circumstances of this case. 


For the reasons explained above, the Commissioner is satisfied that the 
conditions from section 55A (1) DPA have been met in this case. He is 
also satisfied that the procedural rights under section 55B have been 


complied with. 


The latter has included the issuing of a Notice of Intent, in which the 
Commissioner set out his preliminary thinking. In reaching his final 
view, the Commissioner has taken into account the representations 


made by Seaview on this matter dated 28 February 2022. 


Having considered those representations the Commissioner remains 
satisfied that there are valid grounds for proceeding to issue a 
monetary penalty in this case. Since the contravention period the 
Commissioner has received a further two complaints which both 
indicate that Seaview were undertaking marketing calls asking 
individuals to ‘take out’ insurance. The Commissioner has also made 
enquiries with an organisation which provides call blocker 
units to individuals and is approved by Trading Standards. The 
evidence provided by them suggests that several calls made during the 
contravention period by Seaview were to subscribers classified by them 


to be very vulnerable or vulnerable. 


The Commissioner is accordingly entitled to issue a monetary penalty 


in this case. 
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The Commissioner has considered whether, in the circumstances, he 


should exercise his discretion so as to issue a monetary penalty. 


The Commissioner has considered the likely impact of a monetary 
penalty on Seaview. He has decided on the information that is available 
to him, that a penalty remains the appropriate course of action in the 


circumstances of this case. 


The Commissioner’s underlying objective in imposing a monetary 
penalty notice is to promote compliance with PECR. The making of 
unsolicited direct marketing calls is a matter of significant public 
concern. A monetary penalty in this case should act as a general 
encouragement towards compliance with the law, or at least as a 
deterrent against non-compliance, on the part of all persons running 
businesses currently engaging in these practices. This is an opportunity 
to reinforce the need for businesses to ensure that they are only 
telephoning consumers who are not registered with the TPS and/or 


specifically indicate that they do not object to receiving these calls. 


For these reasons, the Commissioner has decided to issue a monetary 


penalty in this case. 


The amount of the penalty 


Taking into account all of the above, the Commissioner has decided 
that a penalty in the sum of £15,000 (Fifteen thousand pounds) is 
reasonable and proportionate given the particular facts of the case and 


the underlying objective in imposing the penalty. 


Conclusion 
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The monetary penalty must be paid to the Commissioner’s office by 
BACS transfer or cheque by 13 April 2022 at the latest. The monetary 
penalty is not kept by the Commissioner but will be paid into the 


Consolidated Fund which is the Government’s general bank account at 
the Bank of England. 


If the Commissioner receives full payment of the monetary penalty by 
12 April 2022 the Commissioner will reduce the monetary penalty by 
20% to £12,000 (Twelve thousand pounds). However, you should 
be aware that the early payment discount is not available if you decide 


to exercise your right of appeal. 


There is a right of appeal to the First-tier Tribunal (Information Rights) 


against: 


(a) the imposition of the monetary penalty 
and/or; 
(b) the amount of the penalty specified in the monetary penalty 


notice. 


Any notice of appeal should be received by the Tribunal within 28 days 
of the date of this monetary penalty notice. 


Information about appeals is set out in Annex 1. 


The Commissioner will not take action to enforce a monetary penalty 


unless: 


e the period specified within the notice within which a monetary 
penalty must be paid has expired and all or any of the monetary 


penalty has not been paid; 
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e all relevant appeals against the monetary penalty notice and any 


variation of it have either been decided or withdrawn; and 


e the period for appealing against the monetary penalty and any 


variation of it has expired. 


82. In England, Wales and Northern Ireland, the monetary penalty is 
recoverable by Order of the County Court or the High Court. In 
Scotland, the monetary penalty can be enforced in the same manner as 
an extract registered decree arbitral bearing a warrant for execution 


issued by the sheriff court of any sheriffdom in Scotland. 


Dated the 11t" day of March 2022. 


Andy Curry 

Head of Investigations 
Information Commissioner’s Office 
Wycliffe House 

Water Lane 

Wilmslow 

Cheshire 

SKI SAF 
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ANNEX 1 
SECTION 55 A-E OF THE DATA PROTECTION ACT 1998 
RIGHTS OF APPEAL AGAINST DECISIONS OF THE COMMISSIONER 


1. Section 55B(5) of the Data Protection Act 1998 gives any person 
upon whom a monetary penalty notice has been served a right of 
appeal to the First-tier Tribunal (Information Rights) (the ‘Tribunal’) 


against the notice. 
2. If you decide to appeal and if the Tribunal considers: - 


a) that the notice against which the appeal is brought is not in 


accordance with the law; or 


b) to the extent that the notice involved an exercise of 
discretion by the Commissioner, that he ought to have exercised 


his discretion differently, 


the Tribunal will allow the appeal or substitute such other decision as 
could have been made by the Commissioner. In any other case the 


Tribunal will dismiss the appeal. 


3. You may bring an appeal by serving a notice of appeal on the 


Tribunal at the following address: 


General Regulatory Chamber 
HM Courts & Tribunals Service 
PO Box 9300 

Leicester 

LEi 8DJ 
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Telephone: 0203 936 8963 


Email: grc@justice.gov.uk 


a) The notice of appeal should be sent so it is received by the 


Tribunal within 28 days of the date of the notice. 

b) If your notice of appeal is late the Tribunal will not admit it 
unless the Tribunal has extended the time for complying with this 
rule. 


The notice of appeal should state: - 


a) your name and address/name and address of your 


representative (if any); 


b) an address where documents may be sent or delivered to 


you; 

c) the name and address of the Information Commissioner; 
d) details of the decision to which the proceedings relate; 
e) the result that you are seeking; 

f) the grounds on which you rely; 


g) you must provide with the notice of appeal a copy of the 


monetary penalty notice or variation notice; 


h) if you have exceeded the time limit mentioned above the 


notice of appeal must include a request for an extension of time 
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and the reason why the notice of appeal was not provided in 


time. 


5. Before deciding whether or not to appeal you may wish to consult 
your solicitor or another adviser. At the hearing of an appeal a party 
may conduct his case himself or may be represented by any person 


whom he may appoint for that purpose. 


6. The statutory provisions concerning appeals to the First-tier 
Tribunal (Information Rights) are contained in section 55B(5) of, and 
Schedule 6 to, the Data Protection Act 1998, and Tribunal Procedure 
(First-tier Tribunal) (General Regulatory Chamber) Rules 2009 
(Statutory Instrument 2009 No. 1976 (L.20)). 
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